Public Snapshots
Last updated
Was this helpful?
Last updated
Was this helpful?
Lab: .
Next we need to provide the Amazon Resource Name (ARN) of the role under our control (i.e. in our own AWS account), as well as a target S3 bucket in the AWS account whose ID we want to enumerate. Here we have created the role and provided it for you.
This reveals the AWS account ID 107513503799. We can use this information to hunt down public resources that might have been accidently exposed by the account owner, such as public EBS and RDS snapshots.
First, it would be good to know the AWS region that the S3 bucket was created in, as public snapshots are available to all users in the same region that the EBS or RDS snapshot was created in. It's likely that if the S3 bucket was created in a specific region, that other resources will be available there too!
To find the S3 bucket region we can use another trick, this time with cURL.
In the response headers we see that the header x-amz-bucket-region is set to us-east-1, which is North Virginia. Next, log into the AWS management console in your own personal AWS account and make sure that the us-east-1 region is selected.
In this lab, we’ll perform basic enumeration against an exposed AWS S3 bucket linked from a public-facing web service. We’ll extract the AWS Account ID that owns the bucket — a valuable piece of information for cloud pentesting, as it can be used to track down other public AWS resources like EBS and RDS snapshots. We’ll walk through:
Discovering a service and identifying an S3 bucket
Enumerating the AWS Account ID via role assumption
Identifying the S3 bucket’s region
Searching for publicly exposed snapshots owned by that account
Publicly exposed EBS and RDS snapshots can unintentionally leak sensitive data or system configurations if not secured properly (e.g. ).
We start by scanning the target IP for open ports:
Visiting the site's source code reveals some images being loaded from an AWS S3 bucket (Figure 2). By visiting https://mega-big-tech.s3.amazonaws.com, we can list the bucket’s contents if permissions allow it (Figure 3).
We’re provided with AWS credentials to assume a role for this lab that will allow us to execute commands in a specific user context, in this case, have the s3:GetObject and s3:ListBucket permissions.
Assuming a role that's assigned one of these permissions is required for the
s3-account-searchscript to work.
This Python script is a cloud enumeration utility designed to brute-forces the AWS account ID of a target S3 bucket’s owner by:
Assuming a provided IAM role in your account.
Incrementally testing IAM policies that allow access only if the resource belongs to an account whose ID starts with specific digits.
Brute-forcing one digit at a time by checking whether access is allowed, using AWS’s s3:ResourceAccount condition key.
Repeating this until the full 12-digit account ID is discovered.
We can use curl to check which region the bucket resides in. This is crucial because public snapshots are only visible in their home region.
Now log into your personal AWS account, and in the us-east-1 region (Figure 4.1). Once logged-in:
Go to EC2 → EBS Snapshots (Figure 4.2 & 4.3)
Select Public Snapshots (Figure 4.4)
In the search bar, type: Owner = 107513503799 (Figure 4.5)
Once we have the owner's ID, after configuring the region, we can enumerate public snapshots via the CLI.
In this lab you learned to:
Scan for open services
Identify S3 bucket references in web pages
Interact with AWS CLI and configure credentials
Use Security Token Service (STS) to verify the active identity
Enumerate a bucket owner’s AWS Account ID
Identify a bucket’s region using HTTP headers
Search for public AWS resources (like EBS snapshots) associated with that account
S3 Bucket
Cloud-based object storage container
AWS Account ID
Unique 12-digit AWS account identifier
Role
Temporary credentials allowing users/services to assume permissions
Security Token Service
API to retrieve details about the current identity
Public Snapshot
An EBS/RDS snapshot marked public and accessible by anyone in its region
The script attempts to enumerate the AWS Account ID of the target S3 bucket by using our credentials and a role we control.
